REMARKS 

Reconsideration of the above-identified application in view of the amendments 
above and the remarks following is respectfully requested. 

Claims 1, 3, 5 - 9, 1 1, 13, 14, and 21 - 26 are in this case. Claims 1, 3 a 5 - 9, 
11, 13, and 14 have been rejected under 35 USC §112 and 35 USC §102. Claims 21 - 
26 have been rejected under 35 USC §102. 

In response to the Examiner's analysis: claims 1, 3, and 5-8 have been 
cancelled. Claim 9 has been amended to take into consideration the Examiner's 
comments regarding the §112 rejection. Furthermore, independent claims 9 and 21 
have been amended to take into consideration the Examiner's analysis regarding the 
§102 rejections based on the pr ior ar t of Galea US 2002/0004908. 

No new material has been entered, and claim amendments which distinguish 
the present invention over the prior art are fully-supported by the specification as 
originally filed. 

The Applicants therefore believe that claim 9 now complies with 35 USC 
§1 12; and that claims 11, 13, and 14, which depend therefrom, likewise comply with 
35 USC §112. Furthermore, the Applicants believe that the amendments to 
independent claims 9 and 21 clearly distinguish the present invention as being novel 
and non-obvious over the prior art, and therefore in compliance with 35 USC §102; 
and that the remainder of the claims, which depend therefrom, ate likewise in 
compliance with 35 USC §102, 

§112 Rejections 

In response to the Examiner's analysis, the Applicants have cancelled claims 
1, 3, and 5 - 8, and have amended claim 9 in accordance with the Examiner's 
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observations. Regarding the term "original component", the Applicants have elected 
to delete the term "original" from claim 9. 

§102 Rejections 

The Examiner has rejected claims 1,3,5-9, 11, 13, 14, and 21-26 under 35 
USC §102 as being anticipated by Galea (US 2002/0004908), which discloses a 
system and method for' detecting the presence of viruses in electronic mail. As 
illustrated below, however, the present invention has novelty over Galea in that 
according to embodiments of the present invention, the detecting and correcting of 
malicious email involves analysis and correcting of formatting and structure of the 
email over and above analyzing the content of the email In contrast, Galea relates 
only to the content of the email and does not address issues of formatting and 
structure. The current amendments to independent claims 9 and 21 of the present 
invention therefore feature rules other than those directed to the content of email 
components, in order to distinguish the present invention from Galea, 

It is fust noted that in the present art, the terms "format" and "structure" are 
related and are generally understood to denote concepts characterized as "the 
organization of information according to preset specifications" and "the arrangement 
of data for storage or display". The emphasis on "arrangement" and "organization" 
clearly excludes consideration of the content and the intended meaning or purpose 
thereof. The Applicants therefore maintain that regarding data and information, a clear 
distinction exists in the art between the concept of "content" and the concepts of 
"format" or "structure". 

(The following citations of the present application are identified by the 
paragraph numbers in the published version, US 2005/0081057 .) 
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Regarding the usefulness of analyzing email components for characteristics 
other than content, the present application discloses, for example (with emphasis 
added): 

[0002 of the present application] "The structure of email message s is 
defined for example in RFCs 2822, 2045-2049. According to the 
recommendations of these publications, email messages should appear 
in textual format, i.e. comprise only ASCII characters, contrary to a 
binary format. Thus the structure of email messages is actually flexible, 
despite the existence of definitions regarding email structure. 
Moreover, email clients try to handle deviations from what is 
considered as standard in order to enable communication between as 
many email clients as possible/ 5 

It is also noted that the above-referenced publication RFC 2822 is titled 
"Internet Message Format" and relates to issues of formatting and structure of 
electronic mail without regard for the content thereof 

The below citations from the present application teach that it is advantageous 

to analyze email for properties other than content, because other properties may be 

exploited for malicious purposes. 

[0003 of the present application] "The relatively free structure may be 
exploited by 'hackers' for introducing hostile content into recipients' 
computers, mail servers and inspection facilities (i.e. systems for 
detecting hostile content within email messages) operating between 
senders and recipients, 7 ' 

[0017 of the present application] "FIG, 2 schematically illustrates a 
buffer overflow attack. The computer memory 20 'holds' an email- 
client software 21, an email message 22, and a system stack 23, Using 
a malformed structure of the email message 22, the content of the 
email message 22 may overwrite the memory allocated for the system 
stack 23." 

[0045 of the present application] "As mentioned above, a well-known 
vulnerability of email-related systems is the length of some of the 
formats, which, for example, at Base64 should be a multiple of 4, i.e. 
4, 8, 12, 16, 32, 64 bytes, and so forth./' 
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Accordingly, the present invention teaches analyzing email properties other 
than content, such as the structure: 

[0046 of the present application] 'Therefore, the present invent ion 
provides a method and module for preventing exploiting email 
messages by using uncommon structure thereof,'' 

In contrast, Galea is directed to detecting and neutr alizing the threat of viruses 
and malicious code contained in electronic mail, and thus discusses analyzing and 
collecting email only according to content. 

It is significant that Galea makes no use or mention of the terms "format", 
"structure", "form" or any related terms or concepts. Galea is thus completely silent 
on issues involving format and structure of email 

Instead, Galea clearly relates only to data content, as exemplified below 
(emphasis added). In particular. Galea stresses analyzing email for content such as 
tags, macros, and operable program code, and the content-oriented nature is 
underscored by Galeas's use of terms such as "contain", "containing", and "the 
presence of: 

[Abstract of Galea] "An anti-virus system for electronic mail messages 
having detection means for determining the presence of an electronic 
mail message and analyzing and scanning means for detecting in the 
electronic mail message any tags indicating the presence of operable 
program code, such tags and operable code are removed from the 
electronic message before the message is delivered to the intended 
recipient. Means may also be provided for separately scanning the body 
and attachments of the message and for quarantining either body text or 
an attachment that is found to contain operable code until a decision is 
made whether the operable code should be deleted." 

[0006 of Galea] "According to the present invention there is provided 
an anti-virus system for an electronic mail message, the system 
including means for determining the presence of the electronic mail 
message; means for analysing and scanning the electronic mail 
message for tags indicating the presence of operable program code 
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and for removing any such tags and operable program code from the 
electronic mail message; and means for applying the electronic mail 
message with the tags and operable program code removed to server 
means." 

[001 1 of Galea] "Advantageously the means for analysing and 
scanning includes means for scanning attachments for operable 
macros" 

[0046 of Galea] "...The bodies and attachments are sequentially 
scanned, step 104, to determine whether any of the said bodies or 
attachments contains a character string indicating the presence of 
operable program code, ... If a script tag is found in an embodiment or 
attachment, the program is removed, step 105, from the body or 
attachment and preferably replaced with replacement text. Such 
replacement text may indicate to the eventual recipient of the electronic 

mail message that operable code has been removed Alternatively, 

the message containing script tag may be quarantined until 
subsequently released or deleted," 

[0047 of Galea] "Simultaneously, or sequentially, the attachments are 
scanned to determine the presence of macros* as illustrated in FIG. 2. 
As already described in relation to FIG, 1, incoming or outgoing 
electronic mail messages are received by the electronic mail server, 
step 201, and an electronic mail message is isolated, step 202, and any 
attachments 212,213 are removed, step 203, from the electronic mail 
message and sequentially scanned to determine whether the 
attachments contain macros^ step 214, If a macro is detected within an 
attachment, the attachment may either be deleted, step 215, or 
quarantined, step 216. Alternatively, the macro may be quarantined and 
the attachment released with the macro removed.. If the macro or 
attachment is quarantined, a decision will subsequently be made, step 
217, whether the macro or attachment should be deleted, or 
reassembled and reattached to the electronic mail message, step 218, or 
for warded by other means to the intended recipient. If no macros are 
found in the attachment, then the attachment is reattached to the 
electronic mail message, step 218, and the electronic mail message is 
passed back to the electronic mail server, step 219, for forwarding, step 
220, to the intended recipient. If an attachment has been deleted then a 
new attachment may be attached to the electronic mail message 
indicating to the intended recipient that the original attachment has 
been removed. In this manner, the method of 1 the invention 
automatically removes any attachments from an electronic mail 
message which have the capability of running program codes or 
external programs by using macros. That is } all macros or attachments 
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containing macros are removed and deleted, or at least quarantined, 
whether they are harmful or not/ 1 

As indicated above. Galea fails to disclose analyzing email for any aspect other 
than content. That is, Galea fails to teach or suggest anything involving formatting or 
structure of email components. 

Therefore, the Applicants maintain that analyzing and correcting email 
components for aspects other than content (i..e*, by format or structure) is a novel and 
non-obvious feature of the present invention. This novel and non-obvious feature has 
thus been incorporated into independent claims 9 and 21 ., Accordingly, the Applicants 
respectfully submit that the amended claims as presented herein serve to clearly 
distinguish the present invention from Galea. 

Support for the present claim amendments is found in the above citations from 
the present application, 
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In conclusion, the Examiner's comments have been given careful and thorough 
consideration in the above amendments to the application. In view of the above 
amendments and remarks it is respectfully submitted that the present claim 
amendments are responsive to the Examiner's Action and that the presently-amended 
claims are in condition for allowance. Accordingly, a notice of allowance is 
respectfully and earnestly solicited. 




Respectfully submitted, 



Mark M. Friedman 
Attorney for Applicant 
Registration No, 33,883 



Date: September 3, 2006 
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